« first day (2290 days earlier)      last day (2271 days later) » 

goldilocks
goldilocks
13:07
@nyx00 I bounced your migration from Software Engineering and after talking to one of the mods there I though I should explain a bit further -- I was thinking they might take it back, but apparently it would be considered "too broad" anyway. The same is true here and I think most of the Stack Exchange technical sites.
The problem is that, "What do I have to consider security sided" is a bit too open ended. I suppose you might be able to generalize it more and try the Security site, or focus on the python aspect and ask about it on S.O. But, particularly in the latter case, that is something you might as well research yourself online and then ask something more specific once you have a more focused context.
To illustrate what mean, if that elicited any answers at all, they would likely be a hodge podge of things stating the obvious -- use encryption and authentication -- or the outlandish (describing any and all ways someone could hack a pi/online device/computers-in-general).
WRT "encryption and authentication" my recommendation would be you investigate how
Public key infrastructure
A public key infrastructure (PKI) is a set of roles, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates and manage public-key encryption. The purpose of a PKI is to facilitate the secure electronic transfer of information for a range of network activities such as e-commerce, internet banking and confidential email. It is required for activities where simple passwords are an inadequate authentication method and more rigorous proof is required to confirm the identity of the parties involved in the communication and to validate the information...
...works. Basically, you want to generate your own "certificate authority" (CA) certificate and use that to sign certs for the pi and your update server. Then the software at both ends only regards your CA and those it endorses as trustworthy -- this is called a chain of trust. The same thing is done with VPNs (virtual private networks). Which, as an alternative, is what you could use, since this will probably save you the task of creating the PKI (look into "easyrsa").
Generating and using certs yourself isn't that hard though, three tools commonly used would be openssl, java' keytool, and GnuTLS's certtool (they all do more or less the same thing). Likely there is something python based around too, which would help to ensure the fit.
Sheesh I might as well re-open that and paste this in as an answer, lol.

« first day (2290 days earlier)      last day (2271 days later) »